Audit log

Every state-changing event for Themis Protocol: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-29 17:23:43Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,983,065

   sig

   4yjzmpwwyPMR…n6cwUvV4copyexplorer ↗

   hash

   3u8mCiHYZQdF…fQvwmGJhcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5962 B) ▸

   {"actor":"system:backfill","investigation_id":"1848f0de-42fd-40f9-ba1b-84c8aa72ef2a","kind":"publish","page_slug":"themis-protocol","published_at":"2026-05-29T17:23:43.305Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Themis Protocol","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.themis.exchange/themis-the-first-defi-nft-lending-protocol-raises-2m-with-multiple-backers-including-dao-maker-4554fb9f578f","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/themis-protocol","type":"other","url":""},{"credibility":3,"name":"https://github.com/Themis-protocol/Introduction","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://neptunemutual.medium.com/how-was-themis-protocol-exploited-79844ff4f97b","type":"other","url":""},{"credibility":3,"name":"https://smartcontract.tips/articoli/flash-loan-attack-themis-en/","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/themis-protocol-hack-analysis-7241f6470b2e","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=themis-protocol-hacked-shortly-after-going-live","type":"other","url":""},{"credibility":3,"name":"https://arbiscan.io/address/0xdb73eb484e7dea3785520d750eabef50a9b9ab33","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://neptunemutual.medium.com/how-was-themis-protocol-exploited-79844ff4f97b","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/themis-protocol-hack-analysis-7241f6470b2e","type":"other","url":""},{"credibility":3,"name":"https://github.com/Themis-protocol/Solidity-Open-Source/issues/1","type":"other","url":""},{"credibility":3,"name":"https://smartcontract.tips/articoli/flash-loan-attack-themis-en/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptorank.io/news/feed/1ea76-198354-themis-protocol-370000-damage-due-to-flashloan-attack","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.net/news/security/21237749/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=themis-protocol-hacked-shortly-after-going-live","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/themis-protocol","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=themis-protocol-hacked-shortly-after-going-live","type":"other","url":""},{"credibility":3,"name":"https://github.com/Themis-protocol/Solidity-Open-Source/issues/1","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/themis-protocol-hack-analysis-7241f6470b2e","type":"other","url":""},{"credibility":3,"name":"https://neptunemutual.medium.com/how-was-themis-protocol-exploited-79844ff4f97b","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://arbiscan.io/address/0xdb73eb484e7dea3785520d750eabef50a9b9ab33","type":"other","url":""},{"credibility":3,"name":"https://neptunemutual.medium.com/how-was-themis-protocol-exploited-79844ff4f97b","type":"other","url":""},{"credibility":3,"name":"https://smartcontract.tips/articoli/flash-loan-attack-themis-en/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/themis-protocol","type":"other","url":""},{"credibility":3,"name":"https://cryptorank.io/news/feed/1ea76-198354-themis-protocol-370000-damage-due-to-flashloan-attack","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=themis-protocol-hacked-shortly-after-going-live","type":"other","url":""}]}],"sources_used":[],"summary":"Themis Protocol is a DeFi lending and borrowing platform deployed on Arbitrum that allows users to collateralize Uniswap v3 LP positions and Balancer LP tokens to borrow stablecoins and blue-chip assets. On June 27, 2023, approximately eleven days after its beta launch, the protocol suffered a flash loan oracle manipulation exploit resulting in approximately $370,000 in losses. The attacker laundered the stolen funds via Tornado Cash, the protocol was suspended indefinitely, and TVL effectively dropped to near zero following the incident.","timeline":[{"date":"2021-11-01","event":"Themis Protocol announces $2 million seed round with backers including DAO Maker, NFX, LD Capital, and Ghaf Capital.","source":""},{"date":"2022-03-28","event":"A High Risk vulnerability in the Uniswap v3 LP pricing formula is filed in Themis Protocol's public GitHub repository, noting that use of spot price (slot0) rather than TWAP makes LP token collateral exploitable via price manipulation.","source":""},{"date":"2023-06-16","event":"Themis Protocol launches in beta on Arbitrum One. TVL grows to approximately $1 million within days.","source":""},{"date":"2023-06-27","event":"Themis Protocol is exploited via a flash loan oracle manipulation attack on Arbitrum One. Approximately $370,000 is stolen by manipulating the Balancer LP token price oracle. Attacker address: 0xdb73eb484e7dea3785520d750eabef50a9b9ab33.","source":""},{"date":"2023-06-27","event":"Themis team suspends borrowing functions and announces an emergency investigation. Team states it is preparing a compensation plan and pursuing fund recovery from the attacker.","source":""},{"date":"2023-06-28","event":"Attacker cross-chains stolen funds via Stargate Finance and begins laundering approximately 191 ETH through Tornado Cash.","source":""},{"date":"2023-06-28","event":"Multiple security firms including Neptune Mutual and SolidityScan publish post-mortem analyses of the Themis Protocol exploit.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7193a11d-1425-4724-a643-8ac46a316ec4copy
2. #2rescoreby systemsystem

   2026-10-27 05:34:40Z
   Score: 32 → 50 (+18)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 50. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −2.4; legitimacy credit long-running +2; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 461,953,908

   sig

   4Sq8HHqHeC3U…uBvoxNTQcopyexplorer ↗

   hash

   J6N9nGWmcmrd…iULMt648copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (684 B) ▸

   {"actor":"system","decided_at":"2026-10-27T05:34:40.390Z","decision":"rescore","investigation_id":"1848f0de-42fd-40f9-ba1b-84c8aa72ef2a","new_score":50,"page_slug":"themis-protocol","prev_score":32,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 50. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −2.4; legitimacy credit long-running +2; no longer operating, so capped at 50.","score_delta":18,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision cb2b1434-293e-472e-839d-3c971b1cbd05copy
3. #3reviewby reviewerreviewer

   2026-11-04 01:13:14Z
   Score: 50 → 50 (no score change)
   The core facts hold. They are the exploit date, the launch date, the loss of about $365-370K, the attacker address, the contract and tx identifiers, and the PeckShield audit claims. Granular transaction figures and the Tornado Cash 191 ETH claim could not be verified because the main source was blocked. The compensation statement may be outdated. Several timeline entries lack sources.
   anchoranchored

   chain

   ●mainnet-betaslot 465,112,863

   sig

   5XVNvgnhrt4B…DZPy9oY6copyexplorer ↗

   hash

   5VR646kABv9h…5xSrtswBcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1241 B) ▸

   {"actor":"reviewer","artifact_identity":"d46c4f8efab97b9e42f927a85ac0a2b8","blocked_count":1,"decided_at":"2026-11-04T01:13:14.062Z","decision":"review","disputed_pct":0.1667,"findings_hash":"8ht3F9AYGgpyVyEk3xrDCcopQWxr2Syoa5Q8aZJXZjXn","investigation_id":"1848f0de-42fd-40f9-ba1b-84c8aa72ef2a","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":50,"page_content_hash":"922889597644e51e6816accd6fcc642876e849f42c7fc90fb1d4821bc592c7fe","page_slug":"themis-protocol","prev_score":50,"reason":"The core facts hold. They are the exploit date, the launch date, the loss of about $365-370K, the attacker address, the contract and tx identifiers, and the PeckShield audit claims. Granular transaction figures and the Tornado Cash 191 ETH claim could not be verified because the main source was blocked. The compensation statement may be outdated. Several timeline entries lack sources.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"scored_claims":6,"sequence_num":3,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ced7cf4e-152e-4cc5-acb1-42ebad7cf452copy
4. #4review reviseby judgejudge

   2026-11-04 01:13:14Z
   Score: 50 → 50 (no score change)
   Of 7 claim findings, 1 was excluded because the source blocked the reviewer (claim_findings[2]), leaving 6. None were disputed and 1 was unverifiable (claim_findings[3], the 2023-06-28 laundering date has no source), giving about 17% and the minor-issues band. The core exploit facts (date, loss of about $365-370K, attacker address, contract and transaction identifiers, audits) were confirmed. The compensation statement (claim_findings[6]) may be outdated, and the Neptune Mutual figures could not be checked because the source was blocked, which limits coverage but does not count against the page. No material omissions were reported and the subject status matches the page.
   anchoranchored

   chain

   ●mainnet-betaslot 465,112,868

   sig

   4GnweM1bcHAD…fNjdcJ7Fcopyexplorer ↗

   hash

   C1WGNPTLeJN8…8iLYx6c2copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1364 B) ▸

   {"actor":"judge","artifact_identity":"d46c4f8efab97b9e42f927a85ac0a2b8","band_override":null,"blocked_count":1,"decided_at":"2026-11-04T01:13:14.062Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1667,"investigation_id":"1848f0de-42fd-40f9-ba1b-84c8aa72ef2a","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":50,"page_slug":"themis-protocol","prev_score":50,"reason":"Of 7 claim findings, 1 was excluded because the source blocked the reviewer (claim_findings[2]), leaving 6. None were disputed and 1 was unverifiable (claim_findings[3], the 2023-06-28 laundering date has no source), giving about 17% and the minor-issues band. The core exploit facts (date, loss of about $365-370K, attacker address, contract and transaction identifiers, audits) were confirmed. The compensation statement (claim_findings[6]) may be outdated, and the Neptune Mutual figures could not be checked because the source was blocked, which limits coverage but does not count against the page. No material omissions were reported and the subject status matches the page.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"scored_claims":6,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 79a07e0a-4655-4a95-906b-999d00d997bbcopy